2.2 Video Acquisition and VerificationYouTube has copyright of all YouTube videos and the permission to download the video file isrestricted (nodownload) as shown in Figure 2.1.1.2 and Figure 2.1.2.2. The acquisition was done using athird-party website https://y2mate.com/ to acquire the two subject videos. This website maintains highestintegrity of YouTube downloaded video files. Refer to Table 2.2.1 showing the acquired file.Acquisition was done using two tools,i. FAW Project – FAW Professionalii. Magnet – WPS

- Last Modified Date: 1st Nov 2018 (Similar with Date Encoded/Tagged Date)Note: This clearly indicated, the video had been modified and it is clearly showing tamperedhad happen.b. Video 2- Showing Published date on Jul 26, 2014- Last Modified Date: 4th Aug 2014iv. Video 1 - “SSU, radio interception of conversations between terrorists, Boeing-777 planecrash.mp4” which contain the intercepted audio tracks (aired by SSU) was tagged/encoded on the01/11/2018 ~ 02:44:30 (UTC). This is the only valid information were seen to be genuine. Refer toTable 3.1.1 showing the detail metadata information from the video file.v. Detail of title of Video 1 showing that ISO Media file produced by Google Inc. Created on:10/31/2018. Refer to Table 3.1.1 and Section 3.3 showing the metadata of Video 1.vi. MH17 flight fatal incident happened on the 17/07/2014, Video 1 was created after ~ 4 years 3months of the recorded intercepted audio. Refer to Table 3.1.1 showing the detail metadatainformation from the video file.vii. There is basically no details of audio track and the the authenticity of the audio tracks file shownor added in the Video file metadata which was uploaded into You Tube social media channel. Referto Table 3.1.1.viii. Analysis on Video 2, MH17 crash leaked tape proven FAKE by audio analysis.Анализ перехватаразговоров ополчения ДНР..mp4 were done at very high level due to the focus of analysis is onthe content of Video 1. Video 2 is basically showing the audio tracks related in Video 1, but it doesnot show the last audio (Audio track 5). Refer to Section 4.0.

Remarksi. Date Published (17/07/2014) doesNOT match with date modified/dateencoded – 11/01/2018. Tampered.ii. The encoded and Tagged dateshowing UTC 2018-11-01 02:44:30which is after ~ 4 years 3 monthsincident of MH17 fatal incident.iii. Total of 3 audio segment with 5audio tracks added/encoded intoVideo 1 audio stream and wereuploaded into YouTube channel.iv. The audio tracks in the video arenot the first/original source oforiginal audio, hence these audiotracks cannot be accepted foranalysis as they are not genuine andnot from original recorded formregardless if this video is genuine.v. Uploaded in YouTube in WeBMformat which had very highcompression and low quality ofaudio (Lossy and exported file size3.26 Mb).vi. The author of the video did notspeak in the video only show text oftranscript in English. No otherspeaker voice in the video exceptfor the speakers in the 5 audiotracks.vii. Refer to Table 3.2.1 for audiostream analysis vii. Refer to Section 3.3 showing themetadata of the Video 1.

Remarksi. Raw Header showing video waslast modified on 04/08/2014ii. Similarly, audio tracks wereadded into this Video 2.iii. Video was paused to explainthat the audio released by SBU wastampered, reasonable pauses fromthe speakers.ii. Background noise remains samethroughout the audio stream.iii. This video was intent to showthe edition on Video 1, but it doesnot show the last audio (Audiotrack 5).iv. Video Published and Date Lastmodified are not the same.v. Refer to Section 5.0

3.2 Audio Track Analysis and Finding Statementsi. Video 1 " SSU, radio interception of conversations between terrorists, Boeing-777 planecrash.mp4” file (source from uploaded YouTube videos) analysis was focused more on the audiostreams as the audio aired in the video was the intercepted recorded audio conversations.ii. There was no speaker in the video speaking before and after the aired audio conversation. It wasintended to show the audio track with details who was speaking and the transcripts. Refer toSection 4.0.iii. The first main requirements and the dependencies for all audio tracks in the video file is the sourceand authenticity of the audio files. It is very important to know when the audio tracks wererecorded, where it was recorded, how it was recorded/stored and how it was recorded. Since thisinformation is not available and undetermined, none of the audio tracks in the video can’t beaccepted as a valid, genuine and authentic source of audio recording. Refer to statement iv. andv. Also refer to Table 3.1.1 and Table 3.2.1.iv. Analysis in Video 1 metadata or content does not show any original source of the audio tracks,none of the audio tracks are genuine. Refer to Table 3.1.1, Table 3.2.1 and Section 4.0.v. YouTube only shows the only details of Video files uploaded as listed in Table 2.1.1 and Table 3.1.1,it does not show the content of the audio track aired in the video container. There is basically noway to get the details of each audio tracks in the audio stream due to it was compress and addedinto single Video 1 container and uploaded into You Tube social media channel. Video 1 containershowing as single audio of Stream# 0.1 (und) below. Refer to Section 3.3 showing Video 1Metadata detail.Stream #0.0(und): Video: h264, yuv420p, 480x360, 25 tbr, 25 tbn, 50 tbcStream #0.1(und): Audio: aac, 44100 Hz, stereo, s16vi. In a way, the audio stream (Stream #0.1) in Video 1 still holds the audio tracks (which was aired bySSU) which can be used analyze each audio tracks and verify the content of the audio. This analysisis based on the audio wave, the spectral of the speaker voice and the background noise floor whichstill can be analyzed of each audio tracks. Refer to Section 4.0 showing the audio stream analysis.vii. Analysis on Video 1 audio stream (Stream #0.1(und): Audio:) showing there are 5 interceptedaudio tracks conversation which were added by SSU in the video file. Refer to Table 3.2.1 showingthe details of each audio tracks. Refer to Section 4.0 showing the audio track analysis.

- Audio is tampered, 3 different tracks recorded indifferent timings and merged as one segment.- A new person voices start to appear instead of Grek’svoice- A new person voices start to appear instead ofMajor’s voice- Audio was cut between time frame 1.24.2 and 1.24.3.- Refer Section 4.4.2, 4.4.3 & 4.4.4- Audio cannot be accepted for Voice ID AnalysisRefer to Table 4.5.1 (Voice ID Analysis)- This audio tracks are tampered and not genuine

- Two different militants’ voices are identified speakingto Kozitsyn,- Edits are seen in this audio track- Different frequencies in the militant track. Nobackground voice appears in Kozitsyn track.- Refer Section 4.4.5- Audio cannot be accepted for Voice ID AnalysisRefer to Table 4.5.1 (Voice ID Analysis)- This audio track is tampered and not genuine.

viii. The Audio 1 Track-1 spectral and noise analysis showing clear edition of the audio track (mono).a. In Audio 1, Track-1 - I. Bezler (“Bes”) and V. Geranin were talking in the conversation as per the video.b. Bezler (“Bes”) voice was recorded in right channel and V. Geranin was recorded in left channel. Original audio is actually a monorecording.c. It is clearly seen in the spectral analysis in audio Track 1 that, V.Geranin voice and Bezler voice speaking at the same time. Thismaking the real conversation being overlapped with one another at 0.18.5, 0:25.75 & 0:31:5. The noise level are seen different forV.Geranin. It is possible phrases were taken from a different conversation and merged. Refer Figure 4.4.1.1.d. Frequency level in spectrogram appears in all three phrases are changing, first phrase appears very low, second phrase appearsto be in high frequency, but middle spectrum was unseen, and third phrase shows medium frequency level. This shows phrasesare from different conversations and a gap which appears at the end of third phrase uttered by V. Gernanin in the Audio 1 Track-1 is clear indication that his voices were overlaid and merged into the conversation. Refer Section 4.4.1.e. A gap which appears at the end of third phrase ~0:32.6 uttered by V. Gernanin in the audio Track-1 (Left Channel) is a definitepossible indication that Geranin voices are merged into the conversation. Audio spectral at 0:31.75 – 0:31.85 (Left Channel)showing added cut, paste and merger of other sound in this audio. Refer Figure 4.4.1.1.f. Seen merged of audio at at 0:22.5, 0:23.5 and 0:30:5 (Refer to Figure 4.4.1.3). Different audio conversation starts at 0:23.30 (Referto Figure 4.4.1.3).

g. Voice samples taken but not meeting the requirement for voice biometric analysis as ithas very short speech below 15 second and the audio quality is low. Refer Table 4.5.1 andTable 4.5.2 showing the audio samples details.i. Bezler’s Audio recording (Refer to Section 4.5.1)Frequency Response: ~ 2013 HzSNR 53 dBVoice: 7.66 sii. V.Geranin’s Audio recordingFrequency Response: ~ 3510 HzSNR 53 dBVoice: 2.24 six. Audio 2 tracks spectral and noise analysis showing edition of the audio (Stereo);a. The audio tracks are in stereo where both left and right channel are similar.b. Analysis in Audio 2, Track-2 showing difference level of background noise level indicationtampering of the audio at audio duration between ~0:43.3 – 0:52.9. Refer Figure 4.4.2.1.c. In Audio 2, Track-3, spectrograms show there were cuts and merging of conversation in thispart from ~0:58:75 and 0:59:0. At ~0:58.85 another difference noise were seen. Refer Figure4.4.3.1.d. In Audio 2, Track-3, second cut and merging can be seen between ~1:03.85 and 1:04.55. Thebackground noise suddenly appears at this duration doesn’t fit to both the speakers’atmosphere. Refer Figure 4.4.3.2.e. In Audio 2, Track-4, third cut and merging can be seen between ~1:13.55 and 1:13.5. Thebackground noise suddenly appears at this duration doesn’t fit to both the speakers’atmosphere. Refer Figure 4.4.4.1.f. In Audio 2, Track-4, fourth cut and merging can be seen between ~1:15.20 and 1:16.20. Thebackground noise suddenly appears at this duration doesn’t fit to both the speakers’atmosphere. Refer Figure 4.4.4.1.g. In Audio 2, Track-4, fifth cut and merging can be seen between ~1:18.80 and 1:19.30. Thebackground noise suddenly appears at this duration doesn’t fit to both the speakers’atmosphere. Refer Figure 4.4.4.2

ii. Major’s Audio recordingFrequency Response: ~2918 HzSNR 34 dBVoice: 12.70 sx. Audio 3 track spectral and noise analysis showing edition of the audio (mono);a. Original audio track is a mono recording channel.b. Audio 3 Track-5 begins from ~1:50.2 and ends at ~2:22.8. This segment of audio has 3 differentindividual voices heard, it appears to be two different militants speaking to Kozitsyn, SBUdidn’t say anything about this in their video. Refer Figure 4.4.5.1c. Militant voice between ~1:50.15 and ~2:02.93 is not the same as Militant voice appears after~2:02.98 till the end of the audio. It is clear the merging can be seen between ~2:02.94 and2:02.97, also sudden difference in the spectrum frequency from ~2:02:98 in Left Channel.Refer Figure 4.4.5.2d. Surprising to see that no background noise was seen in the Kozitsyn track, generally it can beseen in the half duplex (walkie talkie) conversations. It is clear indication the audio track ofKozitsyn was merged and background voices appears from ~2:12.3 until 2:22.28. Refer Figure4.4.5.3.e. Editing can be seen between time frame ~2:12.6 and 2:14.2, suddenly left channel’s spectrumappearing in the right channel – this is clear editing. Refer Figure 4.4.5.3.f. Voice Sample taken but not meeting the requirement for voice biometric analysis as it hasvery short speech below 15 second and the audio quality is low. Refer Table 4.5.1 and Table4.5.2 showing the audio samples details.a. Audio 3 - Track 5 (Refer to Section 4.5.5)i. Kozitsyn’s Audio recordingFrequency Response: ~2207 HzSNR 23 dBVoice: 3.59 sii. Militant 1 Audio recordingFrequency Response: ~2186 HzSNR 35 dBVoice: 6.02 s

iii. Militant 2 Audio recordingFrequency Response: ~2885 HzSNR 37 dBVoice: 6.64 sxi. Analysis on Video 2, MH17 crash leaked tape proven FAKE by audio analysis.Анализ перехватаразговоров ополчения ДНР..mp4 were done at very high level.i. There were many pauses/mutes in the audio stream of Video 2.ii. Pauses/Mute were reasonable in the audio as the speaker was explaining the audio releasedby the SBU.iii. Original audio seems to be a mono recording.iv. There is only one speaker explaining about the audio released by SBU.v. Voices from the audio released by SBU was played in the video to explain about thetampering.vi. The speaker in Video 2 didn’t cover Audio 3, Track-5. The focus of this case is to analyze audiotracks in Video 1. Video 2 is just a reference. Refer to Section 5.0